Adobe is changing the world through digital experiences. Our creative, marketing and document solutions empower everyone — from emerging artists to global brands — to bring digital creations to life and deliver them to the right person
at the right moment for the best results.

Security bulletin

Security Advisory for Adobe Reader and Acrobat

Release date: December 15, 2009

Last updated: December 15, 2009

Vulnerability identifier: APSA09-07

CVE number: CVE-2009-4324

Platform: All Platforms

Summary

Adobe has confirmed a critical vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions that could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild. Adobe recommends customers follow the mitigation guidance below until a patch is available.

Adobe plans to make available an update to Adobe Reader and Acrobat by January 12, 2010 to resolve the issue.

With the DEP mitigation in place, the impact of this exploit has been reduced to a Denial of Service during our testing.

Severity rating

Adobe categorizes this as a critical issue and recommends that users follow the mitigation guidance above until a patch is available.

Details

Adobe has confirmed a critical vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions that could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild. Adobe recommends customers follow the mitigation guidance above until a patch is available. Adobe plans to make available an update to Adobe Reader and Acrobat by January 12, 2010 to resolve the issue.

Adobe actively shares information about this and other vulnerabilities with partners in the security community to enable them to quickly develop detection and quarantine methods to protect users until a patch is available. Adobe recommends that you keep your anti-malware software and definitions up-to-date and monitor releases from your vendor about this issue.